Is Pages a scam? TrustSniffer's high-risk assessment of palm-81o.pages.dev: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a Cloudflare Pages project address on a free, shared hosting subdomain. When the homepage was captured, it returned a Cloudflare interstitial titled "Suspected Phishing" with only a short block of text. It presented no visible products, brand, or business content. It has no identifiable purpose or business model, and the only thing a visitor sees is a platform-level security warning.

Scam/Impersonation Risk

The convergence of signals here is adverse. The site is blacklisted by external threat-intelligence sources, and a meaningful group of security engines flagged it as malicious or suspicious. These included two tier-one vendors, so this is not a lone outlier detection. The platform's own phishing interstitial on the homepage is consistent with those detections. It is a platform warning rather than proof of a specific phishing kit, and no brand impersonation or conflicting legal identities were observed. The risk therefore rests on the confirmed blacklisting and the phishing warning, not on any identity contradiction. Behavioural testing showed no wallet-drainer activity, clipboard manipulation, hidden forms, or externally posting password forms. It did show unusually heavy outbound traffic: the page made a very large share of its requests to external destinations, mostly background fetch calls. It also produced repeated script errors and a large burst of page changes after interaction. That pattern points to a page that loads or swaps content dynamically from elsewhere. Together with the warning, it means the page's real content cannot be relied upon to match what a later visitor might be shown. The site's short operating history and the absence of any independent reputation or traffic standing give no counterweight. Evidence:

• Homepage: the capture was blocked with a bot-challenge response, and the page title reads as a suspected-phishing warning from the hosting platform.
• External reputation: nine engines classed the site as malicious and two as suspicious, including two tier-one security vendors, and an external blacklist flag is active.
• Behavioural sandbox: 88 external background requests, up to about 96% of requests going to external destinations, 11 console errors, and 1,508 page mutations after interaction.
• Domain provenance: first observed December 2024 (~1.9 years of continuity), with only 5 archive snapshots spanning 2024–2026 (3 years tracked).

Regulatory Verification Notes

The only page content observed was a security interstitial. It carried no terms, privacy policy, company name, registration number, or licence information, so no legal identity or regulatory status could be assessed and none should be assumed. The operator is not identifiable, and the shared platform subdomain adds to that ownership opacity. No third-party broker or regulator-style listing matched this site. The assessment therefore rests on security reputation and not on any licensing finding. The site's transport encryption is valid, but it is a basic domain-validated certificate. That shows encrypted transport only and says nothing about the operator's legitimacy. Evidence:

• Homepage: no legal, licensing, or corporate disclosures were present in the captured content.
• Transport security: the TLS certificate was issued by WE1 (DV) and is valid to 2026-12-21, with 52 days remaining.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Reputation: no broker or regulatory-register match was found for this site.

What to Verify Next

Anyone who reached this address through a message, advertisement, or referral should confirm the sender and the intended destination through an independent, offline channel, such as a known phone number or a previously verified official site. Any claimed organisation behind it should be asked to confirm that it operates under a dedicated, registered domain. That domain should be checked against the relevant company or licensing registry. Security teams should re-test the address later, because the page's content is dynamic and the current warning may change. Internal blocklists should be updated in the meantime. If the address appears in unsolicited communications, it should be reported to the hosting platform's abuse process and to the organisation's security contacts. Evidence:

• Homepage: only about 381 characters of text were rendered, which is too little to identify any operator or offering.
• Hosting: the site sits on a shared platform subdomain, not a dedicated domain registered to an identifiable entity.
• Reputation: external detections are active, so any prior assumption of safety should be reset.

Summary Verdict

The available evidence supports a clearly cautionary, high-risk posture. Confirmed external blacklisting and a platform phishing warning outweigh the basic technical hygiene the site exhibits. Its apparent legitimacy cannot be established, and its operator remains unidentified.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and every observed address belongs to Cloudflare edge servers. Only edge addresses were visible, so the hosting origin could not be independently assessed. This is a mitigating factor only. It shows that the site uses mainstream protective infrastructure, which is also freely available to any publisher. It cannot offset the external threat detections.

Closing Assessment

This address should not be used for login, credential entry, payments, or any financial or personal-data interaction, and nothing should be downloaded from it. If it must be examined at all, only passive, isolated viewing is appropriate. Organisations should block or flag it until the detections are cleared and a verifiable operator identity is established.